# Possible to use data-at-rest encryption without Hashicorp Vault? **URL:** \ **Category:** Percona Operator for MySQL\ **Created:** [March 17, 2023, 1:33pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695 "2023-03-17T13:33:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Tatu\_Pesonen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tatu_pesonen/32/9760_2.png) [@Tatu\_Pesonen](https://forums.percona.com/u/Tatu_Pesonen)\ **Post date:** [March 17, 2023, 1:33pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/1 "2023-03-17T13:33:53Z")
Is it possible to just provide the encryption key manually? We don’t want to use Hashicorp Vault. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [March 17, 2023, 7:28pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/2 "2023-03-17T19:28:54Z")
Hello @Tatu_Pesonen, Absolutely! There is no requirement whatsoever to use vault to manage encryption keys in MySQL. You can enable the keyring\_file plugin. [Use the keyring component or keyring plugin - Percona Server for MySQL](https://docs.percona.com/percona-server/8.0/security/using-keyring-plugin.html) ---
**Author:** ![Tatu\_Pesonen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tatu_pesonen/32/9760_2.png) [@Tatu\_Pesonen](https://forums.percona.com/u/Tatu_Pesonen)\ **Post date:** [March 20, 2023, 7:31am UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/3 "2023-03-20T07:31:13Z")
@matthewb Great! And this also works with the Kubernetes Operator? ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [March 20, 2023, 2:32pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/4 "2023-03-20T14:32:29Z")
Yes. The keyring\_file plugin is a native plugin and works with all/any flavor of MySQL. ---
**Author:** ![Tatu\_Pesonen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tatu_pesonen/32/9760_2.png) [@Tatu\_Pesonen](https://forums.percona.com/u/Tatu_Pesonen)\ **Post date:** [March 22, 2023, 8:49am UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/5 "2023-03-22T08:49:05Z")
I couldn’t find any documentation regarding the configuration of data-at-rest without HashiCorp Vault - could you guide me towards some resources that show how you can configure keyring\_file in an environment that uses XtraDB Cluster operator? ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [March 22, 2023, 4:47pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/6 "2023-03-22T16:47:21Z")
You just need to enable the plugin in my.cnf. I believe this is done in cr.yml? ```auto early-plugin-load = keyring_file.so keyring_file_data = /var/lib/mysql-keyring/keyring ``` ---
**Author:** ![Tatu\_Pesonen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tatu_pesonen/32/9760_2.png) [@Tatu\_Pesonen](https://forums.percona.com/u/Tatu_Pesonen)\ **Post date:** [April 11, 2023, 2:08pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/7 "2023-04-11T14:08:29Z")
What if I have multiple nodes? Will they have to share the keyring\_file\_data secret, and if they do, how can I accomplish that? Edit: Also, if I want to manually generate the keyring file, how can I do that? ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [April 11, 2023, 2:38pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/8 "2023-04-11T14:38:31Z")
Each MySQL pod can use its own keyring file, unless you are clustering using the PXC Operator. You can’t generate the keyring file and populate it manually; it is a binary file. ---
**Author:** ![Tatu\_Pesonen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/tatu_pesonen/32/9760_2.png) [@Tatu\_Pesonen](https://forums.percona.com/u/Tatu_Pesonen)\ **Post date:** [April 12, 2023, 7:33am UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/9 "2023-04-12T07:33:05Z")
I am using the PXC operator. Does this mean I’ll have to use Vault? ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [April 12, 2023, 1:56pm UTC](https://forums.percona.com/t/possible-to-use-data-at-rest-encryption-without-hashicorp-vault/20695/10 "2023-04-12T13:56:34Z")
No. You can still use keyring file. Each PXC pod will have it’s own, unique keyring file initially. If a pod is recreated, the SST process will copy the keyring from the donor node and then those two PXCs will have the same keyring file. This has no impact at all on performance/security.